de441cce874689044624c30a142efe5e5318db367577ab70797420e3b56b22dc

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/02/2024, 00:11

Target
9086fd2f5778d1e07100d46e7d6c6830.dll
Size 15KB
Sample240205-ag438seca9
SHA256 de441cce874689044624c30a142efe5e5318db367577ab70797420e3b56b22dc
MD5 9086fd2f5778d1e07100d46e7d6c6830
SHA1 aaf08c43d60eea0f0290e526d94e2f0eebe4eb8b
SHA512 6593d9670e9d0a1662f261aba288fede0b4241de36143bf7a12017fdd4f24faccd507c43bccda600ba1bbd8f503ea9f685b84e2032af4edff7aa551e4b1cf220
SSDEEP 384:4K0QmUQwS18PiEPlwFZ1IpjHRc8uswaQtApNk3ke:8UplhGsunyc3ke
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msindeo.dll	rundll32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7ACB5731-5839-13AB-EABC-124791194525}\InprocServer32	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2292	2868	rundll32.exe	28
PID 2868 wrote to memory of 2292	2868	rundll32.exe	28
PID 2868 wrote to memory of 2292	2868	rundll32.exe	28
PID 2868 wrote to memory of 2292	2868	rundll32.exe	28
PID 2868 wrote to memory of 2292	2868	rundll32.exe	28
PID 2868 wrote to memory of 2292	2868	rundll32.exe	28
PID 2868 wrote to memory of 2292	2868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\9086fd2f5778d1e07100d46e7d6c6830.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\9086fd2f5778d1e07100d46e7d6c6830.dll,#1
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:2292

memory/2292-0-0x00000000001C0000-0x00000000001CA000-memory.dmp

Download

memory/2292-2-0x0000000000160000-0x000000000016B000-memory.dmp

Download

memory/2292-3-0x0000000000160000-0x000000000016B000-memory.dmp

Download

memory/2292-4-0x0000000000160000-0x000000000016B000-memory.dmp

Download